MM-48186: Add a new API endpoint to add a user to their default GroupChannels and GroupTeams. (#21591)

* MM-48186: Add a new API endpoint to add a user to their default GroupChannels and GroupTeams.

* MM-48186: Removed unrelated lint fixes.

* MM-48186: Removed variable from previous iteration.

* MM-48186: Adds translation.

* MM-48186: Not upgrading golang.org/x/text in this pr.

* MM-48186: Validate user ID and auth service.

* MM-48186: Use user id from struct.

* MM-48186: Added basic client test.

* MM-48186: Adds empty translation.

* MM-48186: Added translations.

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

api4/ldap.go

@@ -40,6 +40,7 @@ func (api *API) InitLdap() {
 	api.BaseRoutes.LDAP.Handle("/certificate/public", api.APISessionRequired(removeLdapPublicCertificate)).Methods("DELETE")
 	api.BaseRoutes.LDAP.Handle("/certificate/private", api.APISessionRequired(removeLdapPrivateCertificate)).Methods("DELETE")
 
+	api.BaseRoutes.LDAP.Handle("/users/{user_id}/group_sync_memberships", api.APISessionRequired(addUserToGroupSyncables)).Methods("POST")
 }
 
 func syncLdap(c *Context, w http.ResponseWriter, r *http.Request) {
@@ -419,3 +420,36 @@ func removeLdapPrivateCertificate(c *Context, w http.ResponseWriter, r *http.Req
 	auditRec.Success()
 	ReturnStatusOK(w)
 }
+
+// addUserToGroupSyncables creates memberships—for the given user—to all of their group syncables (i.e. channels or teams).
+// For each group the user is a member of, for each channel and/or team that group is associated with, the user will be added.
+func addUserToGroupSyncables(c *Context, w http.ResponseWriter, r *http.Request) {
+	if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionSysconsoleWriteUserManagementGroups) {
+		c.SetPermissionError(model.PermissionSysconsoleWriteUserManagementGroups)
+		return
+	}
+
+	user, appErr := c.App.GetUser(c.Params.UserId)
+	if appErr != nil {
+		c.Err = appErr
+		return
+	}
+
+	if user.AuthService != model.UserAuthServiceLdap {
+		c.Err = model.NewAppError("addUserToGroupSyncables", "api.user.add_user_to_group_syncables.not_ldap_user.app_error", nil, "", http.StatusBadRequest)
+		return
+	}
+
+	auditRec := c.MakeAuditRecord("addUserToGroupSyncables", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+
+	params := model.CreateDefaultMembershipParams{Since: 0, ReAddRemovedMembers: true, ScopedUserID: &user.Id}
+	err := c.App.CreateDefaultMemberships(c.AppContext, params)
+	if err != nil {
+		c.Err = model.NewAppError("addUserToGroupSyncables", "api.admin.syncables_error", nil, err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	auditRec.Success()
+	ReturnStatusOK(w)
+}

api4/ldap_test.go

@@ -277,3 +277,34 @@ func TestUploadPrivateCertificate(t *testing.T) {
 		require.NoErrorf(t, err, "Should have passed. System Admin privileges %v", err)
 	})
 }
+
+func TestAddUserToGroupSyncables(t *testing.T) {
+	th := Setup(t)
+	defer th.TearDown()
+
+	resp, err := th.Client.AddUserToGroupSyncables(th.BasicUser.Id)
+	require.Error(t, err)
+	CheckForbiddenStatus(t, resp)
+
+	resp, err = th.SystemAdminClient.AddUserToGroupSyncables("invalid-user-id")
+	require.Error(t, err)
+	CheckNotFoundStatus(t, resp)
+
+	resp, err = th.SystemAdminClient.AddUserToGroupSyncables(th.BasicUser.Id)
+	require.Error(t, err)
+	CheckBadRequestStatus(t, resp)
+
+	id := model.NewId()
+	user := &model.User{
+		Email:       "test@localhost",
+		Username:    model.NewId(),
+		AuthData:    &id,
+		AuthService: model.UserAuthServiceLdap,
+	}
+	user, err = th.App.Srv().Store().User().Save(user)
+	require.NoError(t, err)
+
+	resp, err = th.SystemAdminClient.AddUserToGroupSyncables(user.Id)
+	require.NoError(t, err)
+	CheckOKStatus(t, resp)
+}